SGLang EUVD-2026-97433

Requires an SGLang deployment (through 0.5.21) serving a Qwen-VL multimodal model with the /v1/chat/completions endpoint accepting video input, where preprocess_video in qwen_vl.py decodes frames at full source resolution before max_pixels downscaling. Exploitation is amplified by concurrent requests, so a single request may be insufficient; effectiveness scales with the server's memory headroom and any request-size/rate limits. The primary limiting factor is exposure of the inference endpoint: if /v1/chat/completions is authenticated, rate-limited, behind a gateway, or only internally reachable, the PR:N/unauthenticated assumption no longer holds and realistic risk drops sharply.

This is a genuine availability-impact issue rather than an inflated high-CVSS finding, but its real-world priority is moderate and tightly scoped. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack whose entire impact is availability (VA:H; VC:N/VI:N), consistent with CWE-770 unbounded resource allocation - there is no confidentiality or integrity exposure and no code execution. The vendor-assigned 8.7 reflects 4.0's heavier weighting of a clean remote-unauth DoS; a CVSS 3.1 equivalent lands around 7.5, so the headline number is somewhat elevated by the scoring version rather than by severity of outcome. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is not demonstrated in the wild. No public exploit identified at time of analysis. The PR:N claim assumes the /v1/chat/completions endpoint is exposed without authentication, which is deployment-dependent - many SGLang/Qwen-VL deployments sit behind API gateways or internal networks, which materially limits realistic exposure. Net: treat as a patch-soon hardening item for internet-exposed Qwen-VL video inference, not an emergency.

An attacker with network access to a Qwen-VL deployment served by SGLang sends chat-completion requests containing very high-resolution video payloads, which preprocess_video decodes at full source resolution before max_pixels downscaling is applied. By issuing several such requests concurrently, the attacker inflates per-request memory far beyond configured limits and exhausts the inference worker's memory, crashing or stalling the service. No public exploit code was identified, but the technique is straightforward given the documented code path (qwen_vl.py lines 267-306).